It seems build fails with:

/usr/bin/ld: ../lib/lz4.o: relocation R_X86_64_32S against `.rodata' can not be used when making a PIE object; recompile with -fPIE
/usr/bin/ld: ../lib/lz4frame.o: relocation R_X86_64_32S against `.rodata' can not be used when making a PIE object; recompile with -fPIE
/usr/bin/ld: ../lib/lz4hc.o: relocation R_X86_64_32S against `.rodata' can not be used when making a PIE object; recompile with -fPIE
/usr/bin/ld: ../lib/xxhash.o: relocation R_X86_64_32S against `.rodata' can not be used when making a PIE object; recompile with -fPIE
/usr/bin/ld: bench.o: relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a PIE object; recompile with -fPIE
/usr/bin/ld: lz4cli.o: relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a PIE object; recompile with -fPIE
/usr/bin/ld: lz4io.o: relocation R_X86_64_32 against `.rodata' can not be used when making a PIE object; recompile with -fPIE

gcc -DXXH_NAMESPACE=LZ4_ -O3 -Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -shared lz4.c lz4frame.c lz4hc.c xxhash.c -fPIC -fvisibility=hidden -Wl,-soname=liblz4.so.1 -o liblz4.so.1.9.2

This seems to ignore CFLAGS completely..

Indeed. Will take a look.

New try with changes inspired from https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/lz4

I will have to report a bug upstream to get this Makefile fixed.